{"id":"CVE-2026-53909","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-53909","generatedAt":"2026-10-28T09:26:49.682Z","title":"File upload validation functionality relies only on client-side checks, which can be bypassed.","description":"MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.","published":"2026-07-01T13:17:46.000Z","lastModified":"2026-10-25T17:10:00.000Z","status":"Analyzed","sourceIdentifier":"cvd@cert.pl","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-434"],"affected":["mycomplianceoffice/mycomplianceoffice"],"epss":{"score":0.00394,"percentile":0.3346,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://cert.pl/en/posts/2026/07/CVE-2026-53902","tags":["Third Party Advisory"],"source":"cvd@cert.pl"},{"url":"https://mco.mycomplianceoffice.com/","tags":["Product"],"source":"cvd@cert.pl"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53909","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}